IPv4 fragmentation - overlapping fragments

Question

When are overlapping fragments created and why? Is there any legitimate scenario in which they are used or are they just used by attackers, like in the teardrop attack? And how is receiver suppose to reassemble such fragments (since there is more than one way to do that)?

Answer 1

Overlapping fragments shouldn't occur for "normal" traffic. They are usually a sign of someone trying to circumvent some security system.

You are right that there are different ways to reassemble them. Different implementations behave differently, which is why the attack can be used to circumvent firewalls and make those different systems "see" different things.

Another way to do that without overlapping fragments is by sending a TCP packet with a TTL that is too low to reach the destination host, but which is high enough to pass the firewall. The firewall will see the packet, but the destination host won't. If the firewall is naive in its implementation it will cache what it saw. Then if you retransmit the same TCP packet but with different data the firewall will think it's a normal retransmit and not examine the packet again, but for the host it will be the first time it receives that TCP data and it will use the second version.

There are many ways to mislead firewalls. Overlapping fragments is one of them. A good firewall should detect such behaviour and block the session.

Answer 2

Sander Steffann has provided a scenario which is modern reality. However, a pending answer is if overlapping fragments are ONLY evil then why they are supported at all?

Theoretically, IPv4 is generic (read generous) enough to support multiple upper layer protocols and different Layer 2 technologies. Therefore, it says that there exists an maximum transmission unit (MTU) size which can pass through a given layer 2 technology. For example, generally Ethernet has MTU of 1500 bytes.

Now in a network, successive IP packets from an application can traverse through different paths even though they have same destination. These parallel paths may have different MTU sizes. However, the reassembly has to has happen only at destination. Hence two different fragments may have traversed two different paths and in turn got further fragmented into even smaller packets. Now when they arrive at destination, there will be multiple fragments of different sizes which would overlap each other and it is up to destination re-assembly algorithm to handle this case.

The same can also happen if re-transmitted packet takes a different path while the original packet has not yet fully been reassembled.